SB2026090845 - Multiple vulnerabilities in Xen
Published: September 8, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Memory leak (CVE-ID: CVE-2026-62437)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper cleanup of IRQ tracking structures in Xen\'s PCI device and IRQ cleanup handling when an HVM guest with assigned PCI devices is being terminated. A local user can cause the device model to bind IRQs anew during guest termination to cause a denial of service.
2) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-79602)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of HVM emulation return codes in Xen HVM emulation when processing a guest with an assigned PCI device containing an I/O BAR. A local user can trigger a BUG() in Xen to cause a denial of service.
Only x86 systems are affected.
3) Race condition (CVE-ID: CVE-2026-79603)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass intended isolation between guests.
The vulnerability exists due to a race condition between TLB flushing and page scrubbing in Xen\'s x86 PV guest memory management when freeing memory pages while retaining stale TLB entries. A local user can free a memory page while retaining a stale TLB entry to bypass intended isolation between guests.
Only x86 PV guests are affected, and exploitation is relevant when xsm=silo scrub-domheap is configured.
4) Resource exhaustion (CVE-ID: CVE-2026-79604)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in oxenstored when handling xenbus reconnect requests. A local user can repeatedly request xenbus reconnects to cause a denial of service.
Only systems using the Ocaml Xenstored implementation are affected.
5) Out-of-bounds write (CVE-ID: CVE-2026-79606)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in gcopy_segs[] bounds checking when processing guest-supplied segment counts. A remote user can provide an nr_segments value between 12 and 32 to corrupt adjacent memory and execute arbitrary code.
The affected tapdisk process normally runs as root in dom0.
6) Buffer overflow (CVE-ID: CVE-2026-79605)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to missing upper bounds checking in blkif->last_sect handling when processing guest-supplied blkif last-sector values. A remote user can provide a value larger than 7 to access memory beyond the mapped grant and execute arbitrary code.
The affected tapdisk process normally runs as root in dom0.
Remediation
Install update from vendor's website.